0

i have setup 2 VM's on ESXi with FortiGateVM100, and trying to setup HA cluster on it.

I connected 2 fortis interfaces to same port-groups (same vlans). Then i entered same ha group-name, same password, priority 128 on one, and priority 100 on second, rebooted them.

after reboot both of them appears as master and doesn't see each other in HA status.

if i run sniffer on any of them (diag sniffer packet none 6) - i see ha packets from both of boxes (i can distinguish it by mac-addresses). So it seems that VM's can talk to each other, but they don't do it.

Where to dig? how to setup HA on FortiGateVM??

Thanks!

[UPDATE]

Config screenshots:

1) virtual-machine 01: enter image description here

2) virtual-machine 02 (same stuff as 01): enter image description here

3) ha setup on both: enter image description here

4) ha result (fail): enter image description here

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 11, 2017 at 16:25

2 Answers 2

Reset to default
1

Solved. One have to switch promiscous mode security setting to accept on the port-group for heart-beat interfaces inside vswitch configuration.

Improve this answer
0

you must define some settings, like heartbeat interface. This is a example in CLI:

config system ha
    set group-name "TEST"
    set mode a-a
    set password 123456
    set hbdev "port3" 100 "port4" 50
    set arps 10
    set arps-interval 1
    set session-pickup enable
    set override disable
    set priority 200
    set schedule leastconnection
    set monitor "port1" "port2" "wan1" "wan2"
    set pingserver-monitor-interface "port2" "port1"
    set pingserver-failover-threshold 20
end

Can you copy/paste you own ha settings?

to do that, in CLI type config system ha->show

and for best practices, is better if hearbeat interfaces are in a vm port group just for this purpose.

hope it helps!

Bye!

Improve this answer
3
  • Updated initial post with configs. Maybe you know some of debug commands to see what's wrong with clustering?? // Maaan, now i uderstnad what to love Cisco for ;)
    – Karroplan
    Apr 30, 2015 at 8:30
  • Hi again! is there any config in the heartbeat interface?? like ip address or other stuff? The next step is sniffing each interface with diagnose sniffer packet port3 and paste the results! And do some debugs too: diagnose debug application hatalk -1 diagnose debug enable
    – M4niac
    Apr 30, 2015 at 20:09
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 11, 2017 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.